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January 14, 2019 


Dave Mass 
MuckRock News 
DEPT MR 66083 
411A Highland Ave 
Somerville, MA 02144-2516 

Via Email: 66083-24465556&.reauests.muckrock.com 


Re; Public Records Request 


Dear Mr. Mass: 

The City is in receipt of your public records request received on December 21,2018 
("Request”), a copy of which is attached for your reference. 

The City wishes to cooperate to the fullest extent possible with the Public Records Act 
(Government Code section 6250 et seq.). Under established California law, the City is obliged 
to comply with a request for a public record so long as the requester makes a specific and 
focused request for information, that information is maintained by the City in its ordinary course 
of business, the information is disclosable, and the record can be located with reasonable effort. 
The Public Records Act provides for the inspection or copying of existing identifiable public 
records; it does not compel the City to create new records, lists, privilege logs, or reports in 
response to a request. The City is required to determine whether the request, in whole or in 
part, seeks copies of disclosable public records. Ordinarily, this determination must take place 
within ten (10) days of the City’s receipt of the request. The City invoked its right under 
Government Code Section 6253(c)(2) to extend the time to respond to your Request by fourteen 
(14) days to January 14, 2019. 


After a diligent search, the City has made the following determinations with respect to your 
Request for materials related to this agency’s acquisition of, access to, preservation of, or 
disclosure of automated license place readers (ALPR) or ALPR data: 

Request 1: Policies related to the adoption of ALPR technology, including those guiding the 
procurement process or necessary administrative obligations before acquisition. 
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Determination: After a diligent search, the City has determined it does not have records 
responsive to this request within its possession, custody or control. 


Request 2: Training policies, requirements, and materials for automatic license plate reader 
system operators. 

Determination: After a diligent search, the City has determined it does not have records 
responsive to this request within its possession, custody or control. 


Request 3: Databases used to compare data obtained by the automatic license plate reader 
system. 

Determination: After a diligent search, the City has determined it does not have records 
responsive to this request within its possession, custody or control. 


Request 4: Policies related to the retention and security of captured ALPR data, including 
those regarding: 

the length of time after capture that data may be preserved 
exceptions to general data preservation policies 
internal data security and access 
data destruction 

Determination: After a diligent search, the City has determined it does not have records 
responsive to this request within its possession, custody or control. 


Request 5: Policies related to the sharing of captured ALPR data by this agency with other 
agencies, including those directing: 

the manner in which another agency may request data 
- the circumstances under which captured data may be shared, and 

the responsibilities of the recipient agency in regards to data retention and use 
access by this agency to data obtained by automatic license plate reader systems not 
operated by the law enforcement agency. 

Please provide the number of requests made by outside agencies, if applicable. 

Determination: The City has identified records responsive to Request 5 that are within its 
possession, custody or control. Those records that are non-exempt and non-privileged are 
included with this response. The City does not have any records within its possession, custody 
or control identifying the number of requests made by outside agencies to NCRIC; 


Request 6: Policies related to the sale of data or sharing of data with non-law enforcement 
actors. 

If applicable, please provide all agreements between this agency and non-law 
enforcement actors. 

Determination: After a diligent search, the City has determined it does not have records 
responsive to this request within its possession, custody or control. 


Request 7: Policies regarding oversight of automatic license plate reader system use. 
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Determination: After a diligent search, the City has determined it does not have records 
responsive to this request within its possession, custody or control. 

Request 8: Audit Reports. 

Determination: After a diligent search, the City has determined it does not have records 
responsive to this request within its possession, custody or control. 

Request 9: Policies related to maintenance and calibration. Please also provide maintenance 
and calibration schedules and records for the system on file. 

Determination: After a diligent search, the City has determined it does not have records 
responsive to this request within its possession, custody or control. 

Request 10: Any other policies or reports on subjects related to automatic license plate reader 
system use by the agency. 

Determination: After a diligent search, the City has determined it does not have records 
responsive to this request within its possession, custody or control. 


This completes the response to your Request received on December 21,2018. 
If you have any questions please contact me directly at 650-738-7409. 



Sincerely, 

/ 


Sarah Coffey 
City Clerk 
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PACIFICA POLICE 


Pacifica Police Department 
PRA Office 
2075 Coast Hwy 
Pacifica, CA 94044 


December 17, 2018 


To Whom It May Concern: 

Pursuant to the California Public Records Act, I hereby request the following records: 

Materials related to this agency's acquisition of, access to, preservation of, or disclosure of automated 
license plate readers (ALPR) or ALPR data: 

1. Policies related to the adoption of ALPR technology, including those guiding the procurement process or 
necessary administrative obligations before acquisition. 

2. Training policies, requirements, and materials for automatic license plate reader system operators. 

3. Databases used to compare data obtained by the automatic license plate reader system. 

4. Policies related to the retention and security of captured ALPR data, including those regarding: 

- the length of time after capture that data may be preserved 

- exceptions to general data preservation policies 

- internal data security and access 

- data destruction 

5. Policies related to the sharing of captured ALPR data by this agency with other agencies, including those 
directing: 

- the manner in which another agency may request data 

- the circumstances under which captured data may be shared, and 

- the responsibilities of the recipient agency in regards to data retention and use. 

- access by this agency to data obtained by automatic license plate reader systems not operated by the law 
enforcement agency. 

Please also provide the number of requests made by outside agencies, if applicable. 

6. Policies related to the sale of data or the sharing of data with non-law enforcement actors. 

- If applicable, please provide all agreements between this agency and non-law enforcement actors. 

7. Policies regarding oversight of automatic license plate reader system use. 


Page I of 2 






MuckRock News 

DEPT MR 66083 

411A Highland Ave 

Somerville, MA 02144-2516 

66083-24465556@requests.muckrock.com 


8. Audit Reports 

9. Policies related to maintenance and calibration. 

Please also provide maintenance and calibration schedules and records for the system on file. 

10. Any other policies or reports on subjects related to automatic license plate reader system use by the 
agency. 

The requested documents will be made available to the general public, and this request is not being made 
for commercial purposes. 

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance 
of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or 
CD-ROM if not. 

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your 
response to this request within 10 calendar days, as the statute requires. 

Sincerely, 

Dave Maass 


FUed via MuckRock.com 

E-mail (Preferred): 66083-24465556@requests.muckrock.com 

For mailed responses, please address (see note); 

MuckRock News 
DEPT MR 66083 
411A Highland Ave 
Somerville, MA 02144-2516 

PLEASE NOTE: This request is not filed by a MuckRock staff member, but is being sent through MuckRock 
by the above in order to better track, share, and manage public records requests. Also note that improperly 
addressed (i.e., with the requester's name rather than "MuckRock News" and the department number) 
requests might be returned as undeliverable. 
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NCRIC MISSION 


The Northern California Regional Intelligence Center (NCRIC) is a multi-jurisdiction public 
safety program created to assist local, state, federal, and tribal public safety agencies and critical 
infrastructure locations with the collection, analysis, and dissemination of criminal threat information. 
It is the mission of the NCRIC to protect the citizens within its area of responsibility from the threat of 
narcotics trafficking, organized crime, as well as international, domestic, and street terrorism-related 
activities through information sharing and technical operations support to public safety personnel. 

AUTOMATED LICENSE PLATE READER (ALPR) TECHNOLOGIES 

To support authorized law enforcement and public safety purposes of local, state, federal, and tribal 
public safety agencies, the NCRIC utilizes Automated License Plate Reader (ALPR) technology, and 
supporting software, to gather and analyze ALPR data to enable the rapid identification and location of 
vehicles of legitimate interest to law enforcement. ALPR units are attached to law enforcement 
vehicles or deployed at fixed locations, where they collect license plate information from vehicles on 
public roadways and public property. In one common use of ALPR technology, license plate encounters 
are compared against law enforcement "hotlists" - lists of vehicles associated with active 
investigations, for example, related to Amber Alerts or other missing children, stolen vehicles, or stolen 
license plates. The information is also retained for a fixed retention period, though it is only re- 
accessible by law enforcement given a legitimate law enforcement purpose as listed below. 

PURPOSE 


This NCRIC Automated License Plate Reader Policy (ALPR Policy) defines a minimum set of binding 
guidelines to govern the use of Automated License Plate Reader Data (ALPR Data), in order to enable 
the collection and use of such data in a manner consistent with respect for individuals' privacy and civil 
liberties. 

The NCRIC also completed a NCRIC ALPR Privacy Impact Assessment (PIA) to address in further detail 
common privacy and civil liberties concerns regarding Automated License Plate Reader technology. The 
current version of this document is available on the NCRIC web site at www.ncric.org . 

AUTHORIZED PURPOSES. COLLECTION. AND USE OF ALPR DATA 


To support the mission of the NCRIC, Law enforcement personnel with a need and right to know will 
utilize ALPR technology to: 

Locate stolen, wanted, and subject of investigation vehicles; 

Locate and apprehend individuals subject to arrest warrants or otherwise lawfully sought by 
law enforcement; 

Locate witnesses and victims of violent crime; 
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Locate missing children and elderly individuals, including responding to Amber and Silver Alerts; 
- Support local, state, federal, and tribal public safety departments in the identification of 
vehicles associated with targets of criminal investigations, including investigations of serial 
crimes; 

Protect participants at special events; and 
Protect critical infrastructure sites, 

RESTRICTIONS ON COLLECTION OF ALPR DATA AND USE OF ALPR SYSTEMS 

NCRIC ALPR units may be used to collect data that is within public view, but may not be used for the 
sole purpose of monitoring individual activities protected by the First Amendment to the United States 
Constitution. 

ALPR operators may not contact occupants of stolen, wanted, or subject-of-investigation vehicles 
unless the ALPR operators are sworn law enforcement officers. ALPR operators must rely on their 
parent agency rules and regulations regarding equipment, protection, self-identification, and use of 
force when stopping vehicles or making contact. 

ALPR operators must recognize that the data collected from the ALPR device, and the content of 
referenced hotlists, consists of data that may or may not be accurate, despite ongoing efforts to 
maximize the currency and accuracy of such data. To the greatest extent possible, vehicle and subject 
information will be verified from separate Law enforcement information sources to confirm the vehicle 
or subject's identity and justification for contact. Users of ALPR Data must, to the fullest extent 
possible, visually confirm the plate characters generated by the ALPR readers correspond with the 
digital image of the license plate in question. 

All users of NCRIC ALPR equipment or accessing NCRIC ALPR Data are required to acknowledge that 
they have read and understood the NCRIC ALPR Policy prior to use of the ALPR System. 

In no case shall the NCRIC ALPR system be used for any purpose other than a legitimate law 
enforcement or public safety purpose. 

TRAINING 


Only persons trained in the use of the NCRIC ALPR system, including its privacy and civil liberties 
protections, shall be allowed access to NCRIC ALPR Data. Training shall consist of: 

Legal authorities, developments, and issues involving the use of ALPR Data and technology 
- Current NCRIC Policy regarding appropriate use of NCRIC ALPR systems; 

Evolution of ALPR and related technologies, including new capabilities and associated risks; 
Technical, physical, administrative, and procedural measures to protect the security of ALPR 
Data against unauthorized access or use; and 
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Practical exercises in the use of the NCRIC ALPR system 

Training shall be updated as technological, legal, and other changes that affect the use of the NCRIC 
ALPR system occur. 

AUDIT 


Access to, and use of, ALPR Data is logged for audit purposes. Audit reports will be structured in a 
format that is understandable and useful and will contain, at a minimum: 

The name of the law enforcement user; 

The name of the agency employing the user; 

- The date and time of access; 

- The activities executed, including any license plates searched for; 

- The supplied authorized law enforcement or public safety justification for access; and 

- A case number associated with the investigative effort generating the ALPR data query. 

Audit reports will be provided periodically and on request to supervisory personnel at the NCRIC and 
partner agencies. 

In addition, no less frequently than every 12 months, the NCRIC will audit a sampling of ALPR system 
utilization from the prior 12 month period to verify proper use in accordance with the above 
authorized uses. Any discovered intentional misconduct will lead to further investigation, termination 
of system access, and notification of the user's parent agency for appropriate recourse. In addition, 
the auditing data will be used to identify systemic issues, inadvertent misuse, and requirements for 
policy changes, training enhancements, or additional oversight mechanisms. 

These ALPR audits shall be conducted by a senior NCRIC official other than the person assigned to 
manage the NCRIC ALPR function. Audit results shall then be reported to the Director of the NCRIC. 

DATA QUALITY AND ACCURACY 

The NCRIC will take reasonable measures to ensure the accuracy of ALPR Data collected by NCRIC ALPR 
units and partner agency ALPR systems. Errors discovered in ALPR Data collected by NCRIC ALPR units 
are marked, corrected, or deleted in accordance with the type and severity of the error in question. 
Errors discovered in ALPR Data collected from partner agencies' ALPR systems are communicated back 
to the controlling agency to be addressed as deemed appropriate by that agency or in accordance with 
the agency's own ALPR data policies. 

As the downstream custodian of "hotlists", the NCRIC will provide the most recent versions of these 
lists available and ensure the lists are refreshed from state or federal sources on a daily basis. 

3 


Form n 43cb934a-1-14e-4555-b232-84aca4b0a647 



NCRIC Automated License Plate Reader Policy 


The NCRIC acknowledges that, in rare Instances ALPR units may inadvertently capture information 
contrary to the collection guidelines set forth in this policy. Such records will be purged upon 
identification. Any discovered notable increase in frequency of these incidents from specific ALPR units 
or agencies will be followed up with for equipment repairs, camera realignment, or personnel training 
as necessary. 

PHYSICAL AND ELECTRONIC SECURITY OF ALPR DATA: 


Data collected by ALPR systems is stored in a secured law enforcement facility with multiple layers of 
physical security and 24/7 security protections. Physical access is limited to law enforcement staff in 
good standing who have completed background investigations and possess an active security clearance 
at the "SECRET" or higher level. 

NCRIC will utilize strong multi-factor authentication, encrypted communications, firewalls, and other 
reasonable physical, technological, administrative, procedural, and personnel security measures to 
mitigate the risks of unauthorized access to the system. 

RETENTION OF ALPR DATA: 


ALPR Data collected by NCRIC ALPR units or shared from partner agencies' ALPR units shall not be 
retained longer than 12 months, or the length of time required by the partner agency who is custodian 
of the record - whichever is shorter. Once the retention period has expired, the record will be purged 
entirely from all active and backup systems unless a reasonable suspicion has been established that the 
vehicle identified by the ALPR read is connected to criminal activities. 

ALPR records matching an entry in a current law enforcement hotlist will trigger an immediate 
notification to the officer operating the ALPR unit, the active dispatch officer at the agency owning the 
ALPR unit, the NCRIC, and the custodial agency of the hotlist. Such notifications are also subject to a 
maximum retention of 12 months. 

ALPR Data obtained with license plate information not appearing on hotlists, and with no immediate 
reasonable connection to criminal activity, will be retained in secure systems so as to only be made 
accessible to authorized personnel for a maximum period of twelve months, then purged entirely from 
all systems. If during the specified retention period there is information which supports a legitimate 
law enforcement purpose (see above section enumerating AUTHORIZED PURPOSES, COLLECTION, AND 
USE OF ALPR DATA) as to a license plate or partial license plate which was recorded and is retained in 
these systems, then limited access will be permitted for predicate-based querying for potential 
matches against the parameters specific to the legitimate law enforcement purpose. Such events shall 
be recorded in an access log showing date, time, name of person seeking access, agency of 
employment, reason for access, and tracking identifiers such as an agency case number. 
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ALPR records of vehicles having been identified and linked to criminal investigation will be entered into 
the relevant NCRIC database(s) and retained for a period of no more than five years. If during the five- 
year period NCRIC personnel become aware that the vehicle license plate information is no longer 
associated with a criminal investigation, it will be purged from the NCRIC's databases. 

CUSTODIAN OF RECORDS AND RECORDS REQUESTS 

Each agency operating ALPR technology retains control and ownership as the official custodian of its 
records, and must independently verify all external information obtained via NCRIC Information 
Systems. To the extent permitted by law, requests for information under the California Public Records 
Act or Freedom of Information Act or similar applicable laws will be directed back to the owner of the 
requested data. 

SYSTEM MANAGEMENT AND ACCOUNTABILITY 


The NCRIC shall assign a senior officer who will have responsibility, and be accountable, for managing 
the ALPR Data collected and ensuring that the privacy and civil liberties protection and other provisions 
of this ALPR Policy are carried out. This individual shall also be responsible for managing a process for 
maintaining the most current and accurate hotlists available from NCRIC law enforcement sources. 

This individual shall also have the responsibility for the security of the hotlist information and any ALPR 
Data which is maintained by the NCRIC. It remains, however, the personal responsibility of all officers 
with access to ALPR Data to take reasonable measures to protect the privacy and civil liberties of 
individuals, as well as the security and confidentiality of ALPR Data. 

COMMERCIALLY CREATED ALPR DATA 


Except as explicitly authorized below with regard to critical infrastructure, the NCRIC will not share 
NCRIC or partner agency ALPR Data with commercial or other private entities or individuals. 


DISSEMINATION 


The NCRIC may disseminate ALPR data to any governmental entity with an authorized law enforcement 
or public safety purpose for access to such data. The NCRIC assumes no responsibility or liability for 
the acts or omissions of other agencies in making use of the ALPR data properly disseminated. Though 
the NCRIC will make every reasonable effort to ensure the quality of shared ALPR Data and hotlists, it 
cannot make absolute guarantees of the accuracy of information provided. 

ALPR Information may be disseminated to owners and operators of critical infrastructure in 
circumstances where such infrastructure is reasonably believed to be the target of surveillance for the 
purpose of a terrorist attack or other criminal activity. In these situations, the NCRIC also will make 
notification to appropriate local, state, and federal law enforcement agencies. 
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Information collected by the ALPR system shall not be disseminated to private parties, other than 
critical infrastructure owners or operators, as limited above, unless authorized, in writing, by the 
Director of the NCRIC or his designee. ALPR information shall not be disseminated for personal gain 
for any other non-law enforcement purposes. 

POLICY REVISIONS 

NCRIC ALPR Policies will be reviewed, and updated as necessary, no less frequently than every 12 
months, or more frequently based on changes in data sources, technology, data use and/or sharing 
agreements, and other relevant considerations. 

The most current version of the ALPR Policy may be obtained from the NCRIC website at 
http://www.ncric.org/ 
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